Zero‑Click Spyware Delivered via Malicious Online Ads Infects Journalists and Government Devices
What Happened — Researchers at Citizen Lab and Confiant uncovered a campaign in which the Israel‑based ad firm Discover‑Tech used its “Controlium” platform to serve malicious JavaScript in online ads. When the ads rendered, the code automatically infected the viewer’s device with Candiru‑origin spyware, a zero‑click attack that required no user interaction. The campaign reached at least 45 Al Jazeera journalists and was observed on internal networks of multiple government agencies, including the U.S. Department of Defense, NATO, and the IAEA.
Why It Matters for Trust & Control Assurance
- Demonstrates how a third‑party advertising supply chain can become a conduit for covert malware, bypassing traditional endpoint defenses.
- Highlights the need for continuous monitoring of vendor‑provided code and evidence‑based assurance that ad‑tech partners adhere to security controls.
- Directly tests the control objective of third‑party risk management and ongoing oversight, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Media organizations, government and defense agencies, and any entity that allows third‑party ads on its web properties.
Recommended Actions
- Inventory all ad‑tech providers and classify them as high‑risk supply‑chain components.
- Deploy continuous monitoring tools that capture ad‑delivery scripts and validate them against a whitelist of approved code.
- Incorporate ad‑network security checks into your vendor risk management program and retain audit‑ready evidence of compliance.
Source: The Record – Zero‑click spyware infecting devices through online ads
Technical Notes – The attack leveraged malicious JavaScript executed at render time (zero‑click), exploiting no known CVE but abusing the ad delivery pipeline. The spyware performed device fingerprinting, deanonymization, and data exfiltration to Candiru servers. Source: same as above